CVE-2026-102785: YOOtheme Pro Joomla Extension RCE Flaw

CVE-2026-102785 Overview

CVE-2026-102785 is an unauthenticated remote code execution vulnerability in the YOOtheme Pro extension for Joomla, affecting versions 5.0.0 through 5.0.52. The flaw resides in the publicly accessible image transformation handler, which incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory. The vulnerability maps to [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Unauthenticated attackers can achieve remote code execution on affected Joomla sites by abusing signed image URLs to write executable PHP polyglots into web-accessible directories.

Affected Products

YOOtheme Pro 5.0.0 through 5.0.52 (Joomla extension)
Joomla sites running the YOOtheme Pro builder and image transformation handler
Any public-facing deployment exposing the image transformation endpoint

Discovery Timeline

2026-10-22 - CVE-2026-102785 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-102785

Vulnerability Analysis

The YOOtheme Pro image transformation handler accepts a signed URL that describes a sequence of image operations and an output path. The signature is intended to prevent tampering by binding request parameters to a server-side secret.

The binding is incomplete. The signature covers only a subset of the normalized operations and does not fully constrain the output destination. An attacker who observes any legitimate signed image URL on a public page can reuse that signature as a valid token.

Using the reused signature, the attacker appends additional image operations and manipulates the destination path. Path traversal sequences let the handler write the generated artifact outside the intended cache directory into an executable public media directory served by the web server.

Root Cause

The root cause is improper signature coverage over security-sensitive request fields. The handler normalizes operations and destination paths after signature validation, allowing semantically equivalent but malicious inputs to pass verification. Combined with insufficient output path validation, this creates an unrestricted upload condition [CWE-434].

Attack Vector

The attack is network-based, requires no authentication, and no user interaction. An attacker first harvests a valid signed image URL from any public page rendered by the vulnerable site. The attacker then crafts a request that reuses the signature, injects image operations producing a PNG/PHP polyglot, and sets a destination path that traverses into a PHP-executable directory. Requesting the written file via the web server triggers PHP execution under the web application's privileges. See the YOOtheme Official Website for vendor information.

Detection Methods for CVE-2026-102785

Indicators of Compromise

Unexpected .php, .phtml, or polyglot files with image extensions appearing in public media or upload directories
HTTP requests to the YOOtheme image transformation endpoint containing path traversal sequences such as ../ in output parameters
Repeated requests reusing identical image signature tokens with varying operation parameters
New PHP files created under directories like /media/, /images/, or YOOtheme cache paths outside normal deployment workflows

Detection Strategies

Monitor web server access logs for requests to YOOtheme image transformation URLs that include encoded traversal sequences or unusual operation chains
File integrity monitoring on Joomla media, images, and extension cache directories to flag any newly written executable content
Alert on PHP process execution originating from files located under static asset directories

Monitoring Recommendations

Ingest Joomla and web server logs into a centralized analytics pipeline and correlate image handler requests with subsequent file writes
Baseline normal YOOtheme image URL patterns and alert on deviations in parameter structure or output path
Track outbound connections from the web server process following suspicious image handler activity to detect post-exploitation callbacks

How to Mitigate CVE-2026-102785

Immediate Actions Required

Upgrade YOOtheme Pro to a version above 5.0.52 that addresses the signature binding flaw as soon as the vendor patch is available
Audit public media and cache directories for unauthorized .php files or PNG/PHP polyglots and remove any suspicious artifacts
Rotate any secrets, API keys, or credentials stored on the web host that may have been accessible to the web application user
Review web server and Joomla logs for signs of exploitation dating back to the deployment of YOOtheme Pro 5.0.0

Patch Information

Consult the YOOtheme Official Website for official patched release information and upgrade instructions. Apply the vendor-supplied update to all affected Joomla installations and verify the extension version post-upgrade.

Workarounds

Restrict PHP execution in public media, image, and cache directories using web server configuration to prevent polyglot files from being interpreted as code
Place the Joomla site behind a web application firewall with rules blocking traversal sequences and anomalous image handler parameters
Temporarily disable the YOOtheme Pro image transformation handler if business operations allow until the patch is applied
Enforce least-privilege filesystem permissions so the web server cannot write to directories where PHP execution is enabled

bash

# Example Apache configuration to disable PHP execution in media directories
<Directory "/var/www/html/media">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
    php_admin_flag engine off
</Directory>